Clients logging into app.gohighlevel.com immediately spot third-party software instead of your agency platform. Setting up your whitelabel domain replaces that default URL with your own branded subdomain, like app.yourdomain.com, complete with custom login graphics, favicon, and automated SSL encryption.
I will walk through the exact DNS configuration, Agency Settings adjustments, and verification steps I use to map web app domains cleanly without triggering certificate loops.
The Core DNS Record You Need
HighLevel routes web app traffic through a dedicated load balancer. You only need a single CNAME record pointing your desired subdomain to HighLevel’s application server.
Here is the exact record structure to add inside your DNS host (such as Cloudflare, Route 53, or Google Domains):
- Type: CNAME
- Name / Host:
app(orportal,login,crm) - Target / Value:
app.msgsndr.com - TTL: Auto or 300 seconds (5 minutes)
If you manage your zone in Cloudflare, make sure the proxy status is set to DNS Only (Grey Cloud) during the initial setup. Proxying through Cloudflare (Orange Cloud) can interfere with HighLevel’s Let’s Encrypt automated challenge, causing SSL verification to fail. If you run your entire domain stack through Cloudflare, review our guide on connecting Cloudflare custom domains to GoHighLevel for proper edge rules.
Step 1: Add the CNAME Record in Your DNS Provider
Log in to your domain registrar or DNS management dashboard. Locate the DNS records table for your primary agency root domain.
Create a new record using the values below. If your registrar forces fully qualified domain names in the host field, enter app.yourdomain.com.
Type: CNAME
Name: app
Target: app.msgsndr.com
TTL: 300Save the record. Before touching HighLevel’s dashboard, verify that the record resolves publicly across multiple DNS nodes. You can run a standard DNS lookup command in your terminal:
dig +short CNAME app.yourdomain.comIf the response returns app.msgsndr.com., your DNS provider has published the change and you are ready to configure the agency portal.
Step 2: Bind the Whitelabel Domain in Agency Settings
Switch over to your HighLevel Agency View (you must be an Agency Admin to modify this setting). Do not try to add this inside a sub-account, because this controls the top-level app wrapper.
- Click Settings at the bottom left of the agency sidebar.
- Navigate to the Company tab.
- Scroll down to the Whitelabel Domain field.
- Enter your full subdomain:
app.yourdomain.com(replace with your actual domain). - Click Update Company at the bottom of the form.
Once saved, HighLevel queues an automated SSL provisioning job via Let’s Encrypt. This handshake inspects your CNAME record to confirm ownership before issuing the multi-tenant certificate.
Step 3: Update Agency Branding Assets
While the certificate generates in the background, update your visual branding assets on the same Company settings page. These assets display on your new login portal and inside the app header.
Upload assets adhering to these exact dimensions to prevent layout distortion on high-DPI screens:
- Agency Logo: 350px width by 80px height (PNG with transparent background).
- Favicon: 32px by 32px or 64px by 64px (ICO or PNG format).
- Portal Login Banner: 1200px by 800px (JPG or web-optimized PNG).
For custom styling on top of the default HighLevel interface, you can inject custom CSS directly in the Custom CSS textarea located in the Company tab. Here is a basic snippet I use to hide the generic system greeting and tighten the top bar:
/* Clean up top navigation bar padding */
.hl_header--controls { padding-right: 1.25rem;
} /* Ensure logo doesn't stretch beyond header bounds */
.hl_header--logo img { max-height: 42px; width: auto; object-fit: contain;
}Step 4: Configure Email & Funnel Whitelabeling (Don’t Miss This)
Pointing your web app subdomain changes what users see when they log in, but outbound notifications (like password resets and user invites) will still reveal default HighLevel infrastructure unless your email backend matches.
To create a complete agency wrapper, you need two additional layers:
- Dedicated Sending Domain: Configure LC Email so password resets and team notifications dispatch from
notifications@yourdomain.com. Follow our walkthrough on setting up a dedicated email sending domain in GoHighLevel to pass DKIM and SPF checks. - Custom API Domain: In Company settings, you can define a custom API endpoint subdomain (like
api.yourdomain.com) pointing toservices.leadconnectorhq.com.
For agency sites hosted inside HighLevel, check our guide on setting up root domain and WWW redirects in GoHighLevel so visitors landing on yourdomain.com get routed cleanly to your marketing pages while keeping app.yourdomain.com separated for authenticated portal users.
How to Test Your Setup
Do not test your new whitelabel URL in your primary browser where you are already logged in as a super admin. Cached session cookies and service workers will distort the result.
- Open a fresh Incognito / Private browser window.
- Navigate to
https://app.yourdomain.com. - Check the address bar for the lock icon to verify the SSL certificate is issued to your domain or Let’s Encrypt.
- Verify that your custom logo appears above the login credentials box.
- Log in using a standard sub-account user credential to verify dashboard rendering.
You can also run a quick curl test against your HTTPS endpoint to inspect headers and response codes directly from the terminal:
curl -Iv https://app.yourdomain.com 2>&1 | grep -E "(HTTP/|SSL certificate|location:)"You should see a clean HTTP/2 200 or a redirect header pointing to /login, alongside an active TLS handshake.
Troubleshooting Common Whitelabel Errors
If you encounter issues during verification, check these common failure points:
1. The SSL Pending / Certificate Error
If your browser shows an ERR_SSL_VERSION_OR_CIPHER_MISMATCH or Your connection is not private screen, HighLevel has not finished validating your DNS record. If you are stuck on this step, reference our guide to fixing GoHighLevel domain SSL pending errors.
Common causes include having multiple CNAME or conflicting A records on the exact same subdomain. Run this check to see if an unwanted A record exists:
dig +short A app.yourdomain.comIf this returns an IP address while you already have a CNAME configured, delete the A record immediately. Subdomains must have one distinct record type.
2. Cloudflare Universal SSL Conflicts
If your zone runs on Cloudflare and the CNAME record is set to “Proxied” (orange cloud), Cloudflare serves its own edge certificate before the request reaches HighLevel. When HighLevel’s acme-challenge attempts to read the endpoint, it fails.
To fix this, switch the app CNAME to DNS Only, wait 10 minutes, click Update Company in HighLevel to re-trigger the check, and confirm the portal loads before re-enabling any edge rules.
For further platform details, you can consult the official HighLevel Whitelabel Setup Documentation.
Frequently Asked Questions
Can I use my apex root domain (example.com) for the web app?
No. HighLevel requires a CNAME record for the whitelabel web app wrapper, and standard DNS specifications (RFC 1912) do not permit CNAME records at the zone apex (root). Always use a subdomain such as app.yourdomain.com or portal.yourdomain.com for the web app, and reserve your apex root for your agency website or funnels.
How long does SSL provisioning take for a new whitelabel URL?
In most cases, the Let’s Encrypt certificate provisions within 5 to 15 minutes after DNS changes resolve globally. If your DNS TTL was set high (like 86400 seconds) prior to editing, it may take up to 24 hours for older cached records to expire across ISP resolvers.
Will changing my whitelabel domain break existing sub-account user logins?
No. HighLevel handles routing dynamically based on tenant ID. Existing users will simply log into the new URL. However, make sure to update any saved browser bookmarks, auto-fill credentials, and invite emails so your clients do not attempt to use the older domain.
Can I set up unique whitelabel login domains for each sub-account?
The standard agency whitelabel domain applies across the entire HighLevel agency instance. Sub-accounts access the app through your agency-level domain. To offer unique custom-branded login portals for individual enterprise sub-accounts, you need the HighLevel SaaS Pro tier with dedicated custom sub-account branding capabilities enabled.
